gitea，gitea-runner写入docker-compose
This commit is contained in:
@@ -0,0 +1 @@
|
||||
eyJhbGciOiJSUzI1NiIsImtpZCI6Im1hM1JEUGRKUlA5QnM4di1EUGN6VDh3OHVJV3pRWW85eVF2SFRRZGY0MWsifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJrdWJlcm5ldGVzLWRhc2hib2FyZCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VjcmV0Lm5hbWUiOiJhZG1pbi11c2VyLXRva2VuIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZXJ2aWNlLWFjY291bnQubmFtZSI6ImFkbWluLXVzZXIiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjZTE2OWEzYi00NDliLTQ5YTEtYWRmNC1iZWRiODNjZjJiODgiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6a3ViZXJuZXRlcy1kYXNoYm9hcmQ6YWRtaW4tdXNlciJ9.eBHuluVe8-fA8PHah4TQDeYPIssc91bVe7f_jBKtc6LqSJ4pEAFCOV9q5LZUvSAUTEKzJjf1K6HUo0prxG6L9SW6fZ3b788IDAeq68IjlimVXw1IuP3lCLeSdp70J-QF9OEEYIPW9PUelJC5kjQf6pGcQHpM1OvfkGebgKoxzgKyQHTymoKR2R_fVGmCJMwbLi9NJOVvz6McT-tPf312USxtgP5p0u3YKK4KZggxUgkkkxjCUSWIc3TuL6gLuZvdG_T58xGHysdn4IMxuSD5BF-h7mms5B8dmEOn9OtHpZ2BnVw9-TaSL7445YQAPhZHmTxS1al_L05Jk2BGKIIv4w
|
||||
@@ -18,23 +18,83 @@ sudo systemctl restart docker
|
||||
docker info | grep -A 5 "Registry Mirrors"
|
||||
|
||||
|
||||
//gitea-runner（已由 docker-compose-infra-main.yml 管理，host 标签，勿手动 docker run）
|
||||
// 启动：DOCKER_HOST=ssh://root@116.204.74.41 docker compose -f deploy/docker-compose-infra-main.yml up -d gitea-runner
|
||||
// 网络：network_mode host（kubectl 经宿主机 systemd 隧道 k3s-ssh-tunnel.service 访问 181 k3s）
|
||||
// 注意：标签用 GITEA_RUNNER_LABELS="ubuntu-latest:host"（TAGS 无效）；改标签需删 /data/gitea-runner/.runner 重新注册
|
||||
// 镜像：自定义 redfuture-runner:latest（deploy/gitea-runner/Dockerfile，含 nodejs——checkout@v4 是 node action，无 node 报 Cannot find: node in PATH）
|
||||
//k3s
|
||||
//安装前：先写 containerd 镜像加速，否则系统镜像拉 docker.io 超时（181 曾因此 62 天系统 pod 全挂）
|
||||
mkdir -p /etc/rancher/k3s
|
||||
cat > /etc/rancher/k3s/registries.yaml <<'EOF'
|
||||
mirrors:
|
||||
docker.io:
|
||||
endpoint:
|
||||
- "https://docker.m.daocloud.io"
|
||||
"127.0.0.1:5000":
|
||||
endpoint:
|
||||
- "http://127.0.0.1:5000"
|
||||
configs:
|
||||
"127.0.0.1:5000":
|
||||
tls:
|
||||
insecure_skip_verify: true
|
||||
EOF
|
||||
|
||||
//dev 本地 k3s（2026-08-03 装，单节点，ai-agent 等 dev 服务部署于此）
|
||||
// 安装：curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | INSTALL_K3S_MIRROR=cn sh -s - server --node-ip=192.168.0.83 --disable traefik --disable servicelb --write-kubeconfig-mode 644
|
||||
// 配置：/etc/rancher/k3s/registries.yaml（daocloud 加速 + 127.0.0.1:5000 mirror），渲染到 containerd certs.d
|
||||
// kubeconfig：/etc/rancher/k3s/k3s.yaml（127.0.0.1:6443），runner 容器挂载为 /root/.kube/k3s-dev.yaml（与 181 集群 16443 区分）
|
||||
// 卸载：/usr/local/bin/k3s-uninstall.sh
|
||||
//已安装集群补配（无需重装，失败 pod 会自动重建）
|
||||
//主节点：写 /etc/rancher/k3s/registries.yaml 后 systemctl restart k3s
|
||||
//从节点：同样写配置后 systemctl restart k3s-agent
|
||||
//注意：勿用 USTC(docker.mirrors.ustc.edu.cn)/网易(hub-mirror.c.163.com) 等已停服源，
|
||||
// 181 曾因此 62 天系统 pod 全部拉取失败（换成 daocloud 后 5 分钟内恢复）
|
||||
主节点：curl -sfL https://get.k3s.io | sh -s - server \
|
||||
--data-dir /data/k3s \
|
||||
--write-kubeconfig-mode 644 \
|
||||
--disable traefik \
|
||||
--disable metrics-server \
|
||||
--disable local-storage \
|
||||
--disable coredns \
|
||||
--pause-image m.daocloud.io/rancher/mirrored-pause:3.6
|
||||
主节点：cat /data/k3s/server/node-token
|
||||
从节点：cat > /etc/rancher/k3s/config.yaml <<EOF
|
||||
server: https://116.204.74.41:6443
|
||||
token: K105c70ea9181a9f5e6e41f7f0b60bb1e0edb2bb514b84e9ee1b39c83eafad7d823::server:586b394206559f9fb6249df0ecf0148a
|
||||
data-dir: /data/k3s
|
||||
EOF
|
||||
|
||||
//本地镜像仓库（CI 构建产物中转，compose 管理，勿手动 docker run）
|
||||
// 服务名 registry，127.0.0.1:5000（仅本机），数据 /data/registry；runner docker push + k3s containerd 拉取
|
||||
// curl 验证：curl http://127.0.0.1:5000/v2/ai-agent/tags/list
|
||||
//kubernetes-dashboard 管理界面（dev 用 k3s.redpowerfuture.com，NodePort 32000；181 同法，另配域名）
|
||||
//安装
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml
|
||||
kubectl -n kubernetes-dashboard delete secret kubernetes-dashboard-csrf
|
||||
kubectl -n kubernetes-dashboard create secret generic kubernetes-dashboard-csrf --from-literal=csrf=$(openssl rand -hex 32)
|
||||
kubectl -n kubernetes-dashboard patch svc kubernetes-dashboard -p '{"spec":{"type":"NodePort","ports":[{"port":443,"targetPort":8443,"nodePort":32000}]}}'
|
||||
|
||||
//181 k3s 集群（121.37.117.181 = ecs-5ae0-0002 control-plane, 内网 192.168.0.169；worker ecs-5ae0-0001 192.168.0.196）
|
||||
// 与 dev 的 192.168.0.x 是两个不同 VPC（同名网段互不可达），dev 无法加入该集群；公网 6443 未放行
|
||||
// SSH：ssh -i deploy/ssh/key-hw.pem root@121.37.117.181（KeyPair-test.pem 连不上 181）
|
||||
// 集群无业务负载，系统 pod 全 ImagePullBackOff（未配镜像加速）
|
||||
//admin-user 管理员账号
|
||||
kubectl create -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: admin-user
|
||||
namespace: kubernetes-dashboard
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-user
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: admin-user
|
||||
namespace: kubernetes-dashboard
|
||||
EOF
|
||||
|
||||
//永久登录 token（SA secret 永不过期；kubectl create token --duration=0 实际只有 1 小时）
|
||||
kubectl create -f - <<EOF
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: admin-user-token
|
||||
namespace: kubernetes-dashboard
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: admin-user
|
||||
type: kubernetes.io/service-account-token
|
||||
EOF
|
||||
|
||||
//取回 token
|
||||
kubectl -n kubernetes-dashboard get secret admin-user-token -o jsonpath='{.data.token}' | base64 -d
|
||||
|
||||
Reference in New Issue
Block a user